At least in this respect, pfSense is still a clear packet-filter only ;-)
And ideally, it should stay this way while analyzing packet-content
should occur elsewhere (because it also needs much more CPU-power).
Sorry, but I do not agree totally with you: the thing I love with pfSense is that it is possible to install it everywhere, so it could be a _real_ competitor to enterprise products (like Cisco ASA). So, I think that CPU-power should not be a limit.
